Authentication Bypass in Chamilo LMS Open-Source Learning Management System Version 2.0-RC.2

CVE-2026-33715

What is CVE-2026-33715?

Chamilo LMS, an open-source learning management system, faces a significant security issue in version 2.0-RC.2 due to unauthenticated access to the public/main/inc/ajax/install.ajax.php file. Unlike other AJAX endpoints, this file does not incorporate necessary authentication checks. The vulnerability enables an attacker to leverage the test_mailer action to connect to arbitrary SMTP servers via a provided Symfony Mailer DSN string, thus facilitating Server-Side Request Forgery attacks against internal networks. An unauthorized attacker could exploit this flaw to turn the Chamilo server into an open email relay, potentially launching phishing or spam campaigns with emails appearing to originate from the legitimate IP address of the server. Furthermore, error messages returned from failed SMTP connections can leak details about the internal network's architecture and active services. The vulnerability has been remedied in version 2.0.0-RC.3.

References